- From: Adam Barth <w3c@adambarth.com>
- Date: Tue, 9 Jun 2009 00:22:53 -0700
- To: "Mark S. Miller" <erights@google.com>
- Cc: Anne van Kesteren <annevk@opera.com>, Tyler Close <tyler.close@gmail.com>, public-webapps <public-webapps@w3.org>
On Mon, Jun 8, 2009 at 5:59 PM, Mark S. Miller<erights@google.com> wrote: > For concreteness, for the Origin header for these requests, I'll start with > the simplest proposal that meets my goals: no Origin header for either same > origin requests or cross origin requests. But for both the same origin case > and the cross origin case, I am actually indifferent between no Origin > header and an "Origin: null" header. If there's a reason for the "Origin: > null" header, I'm happy with that. Please send "Origin: null" in these cases. The problem with omitting the origin header is that the server can't tell if the request comes from a legacy client or if the header was removed in transit. Also, the Referer header should be on your hit-list as a credential. :) Adam
Received on Tuesday, 9 June 2009 07:23:49 UTC